Question 1

How does CloudThinker secure production access?

Accepted Answer

Brokered identity (per-tool, per-agent, per-human, never a shared role), scoped credentials issued at task time, sandboxed execution where the credential lives in the environment (not the prompt), deterministic tokenization at the egress boundary so sensitive values never reach a third-party LLM in clear form, tamper-evident audit per action, and per-environment approval gates via Auto Mode.

Question 2

Is CloudThinker SOC 2 compliant?

Accepted Answer

Yes — SOC 2 Type II. Every autonomous action taken by CloudThinker agents is logged with a complete audit trail of decisions, rationale, and outcomes to support compliance and accountability requirements. CloudThinker also supports BYOC (Bring Your Own Cloud) for regulated industries that require per-tenant deployment.

Question 3

How does CloudThinker handle PII and sensitive data?

Accepted Answer

Through deterministic tokenization at the egress boundary. Sensitive values (PII, account IDs, internal hostnames, secrets, card numbers) are replaced with stable placeholders before any prompt reaches a third-party LLM. The provider never sees the real value. The mapping lives in CloudThinker's audit log behind a role-scoped key. This is the model that complies with GDPR, CCPA, Vietnam Decree 13, MAS Notice 658, HIPAA, and PCI-DSS — all of which require provable right-to-deletion.

Question 4

What deployment options does CloudThinker offer?

Accepted Answer

Three. (1) SaaS with private connectivity — the fully managed, SOC 2 Type II platform reaches your environment only over Site-to-Site VPN, VPC Endpoint (AWS PrivateLink), or VPC Peering, never the public internet. (2) BYOC — the entire control plane and data plane run inside your AWS, Azure, or GCP account (or on-premise), fully managed by CloudThinker, so data never leaves your perimeter. (3) Custom model — pin inference to your own LLM endpoints (AWS Bedrock, Azure OpenAI, or a self-hosted custom model) so prompts never leave your perimeter either.

Question 5

What happens if an AI agent is compromised?

Accepted Answer

Three layers limit blast radius: (1) the agent never holds the production credential — Connections brokers a short-lived, scoped token at task time; (2) every action runs in an ephemeral sandbox isolated from neighboring tenants; (3) the Auto Mode approval gate is policy-encoded outside the agent, so a misbehaving agent cannot self-escalate past Notify or Act-with-Approval. A compromised agent still cannot reach a production system without the team's policy saying yes to the specific action.

Security by design. Built for the most critical enterprise systems.